When something goes wrong on Windows Server (an unexpected reboot, a service that keeps stopping, an app crash, or failed logins), the details are in the event logs. Event Viewer and PowerShell’s Get-WinEvent let you find them quickly, if you know where to look and which event IDs matter.

The main logs

Log Contains
System Windows components, drivers, services, shutdowns and reboots
Application App crashes, .NET errors, SQL Server, IIS module errors
Security Logons, failed logons, account changes (if auditing is enabled)
Setup Updates and role installation
Applications and Services Logs Per-component logs (TerminalServices, PowerShell, Windows Defender, DNS Server…)

Open Event Viewer with eventvwr.msc.

Filter instead of scrolling

  • Right-click a log → Filter Current Log: choose levels (Critical, Error, Warning), event IDs, sources, and a time range.
  • Custom Views save filters across several logs, for example “all errors in the last 24 hours”.

PowerShell is faster for repeated checks:

# errors and critical events in System, last 24 hours
Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2; StartTime=(Get-Date).AddDays(-1)} |
  Select-Object TimeCreated, Id, ProviderName, Message | Format-Table -Wrap

# specific event IDs
Get-WinEvent -FilterHashtable @{LogName='System'; Id=41,6008,1074} -MaxEvents 20

See PowerShell basics.

Common event IDs and what they mean

ID Log Meaning What to do
41 (Kernel-Power) System The system rebooted without a clean shutdown Check 6008 and what preceded it; possible crash, host event, or forced reset
6008 System “The previous system shutdown was unexpected” Same as above; correlate with times and your provider’s status
1074 System A process or user initiated a restart/shutdown Shows who/what (e.g. Windows Update) rebooted the server
7031 / 7034 System A service terminated unexpectedly Check the service’s own logs; configure recovery actions
7000 / 7009 System A service failed to start, or timed out Dependencies, credentials, missing files
1000 Application Application crash (faulting module named) Update the app, or check the module (e.g. a plugin DLL)
1026 Application .NET runtime error, with exception details Fix the app’s unhandled exception
10016 (DistributedCOM) System DCOM permission warnings Usually harmless noise; safe to ignore in most cases
4624 / 4625 Security Successful / failed logon 4625 floods = brute-force attempts. See Windows Server logon auditing
4740 Security Account locked out Lockout policy triggered; check the source IP
1149 (RemoteConnectionManager) TerminalServices log RDP user authentication succeeded Track who connected via RDP
2004 (Resource-Exhaustion-Detector) System Low virtual memory Add RAM, enable the page file, find the memory hog

Typical investigations

“The server rebooted by itself.”

Get-WinEvent -FilterHashtable @{LogName='System'; Id=41,6008,1074,1076} -MaxEvents 20 | Format-List TimeCreated, Id, Message

1074 shows planned restarts (often Windows Update). 41 or 6008 without 1074 means an unexpected stop: check for bugcheck events (1001), memory exhaustion, and the provider’s maintenance notices.

“A service keeps stopping.” Look for 7031/7034 for that service, then the application’s own log. Set automatic recovery: sc.exe failure "ServiceName" reset= 86400 actions= restart/60000.

“Someone is trying to log in.” Count 4625 events by source IP:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 2000 |
  ForEach-Object { $_.Properties[19].Value } | Group-Object | Sort-Object Count -Descending | Select-Object -First 10

Then protect RDP. See RDP brute-force protection and change the RDP port.

“System files seem broken.” Run the repair tools. See Windows Server SFC and DISM.

Log size and retention

Default log sizes are small, so busy servers overwrite old events quickly. Increase sizes for System, Application and Security:

wevtutil sl Security /ms:524288000      # 500 MB
wevtutil sl System /ms:104857600        # 100 MB

For multiple servers, forward events to a central collector (Windows Event Forwarding), or to a SIEM or log platform.

Quick reference

Task How
Open eventvwr.msc
Recent errors Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2}
Unexpected reboot IDs 41, 6008 (vs 1074 planned)
Service crashes 7031, 7034
App crashes 1000, 1026
Failed logons 4625 (Security)

Related: Windows Server performance tuning and Windows VPS.

  • Windows Server
  • Troubleshooting
  • Logs